Mattermost CVE-2026-4265

The CVSS v3.1 score of 4.3 (Low-Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-exploitable attack requiring low complexity and authenticated access (guest user privileges), with limited integrity impact and no confidentiality or availability impact. This profile suggests unauthorized file posting rather than system compromise. The attack requires authentication (PR:L) and leaves no UI requirement (UI:N), making it suitable for automated exploitation. Without disclosed EPSS data or KEV status confirmation, the real-world risk appears moderate: while integrity impact is limited and requires attacker to be an authenticated guest, the low complexity and lack of user interaction mean this could be exploited at scale in multi-team Mattermost deployments where guest accounts are common. Organizations with strict file governance requirements should prioritize patching, while others may accept brief remediation windows. The absence of publicly disclosed proof-of-concept code keeps opportunistic exploitation likelihood lower than the CVSS suggests, but the logical simplicity of the attack (file metadata reuse) suggests POC development would be straightforward.

An attacker with guest-level credentials in a Mattermost workspace logs into Team A, where they legitimately have upload_file permission, and uploads a file. The application returns file metadata (including file ID). The attacker then navigates to Team B where they lack upload_file permission, constructs a POST request to a channel in Team B using the file metadata from Team A, and successfully posts the file despite lacking authorization. The attack requires only network access and guest credentials—no social engineering or user interaction—and could be automated across multiple channels and teams to distribute unwanted content (malware links, propaganda, etc.) while bypassing access controls.